varnishncsa (1) - Linux Manuals

varnishncsa: Display Varnish logs in Apache / NCSA combined log format


varnishncsa - Display Varnish logs in Apache / NCSA combined log format


varnishncsa [-a] [-C] [-d] [-D] [-F format] [-g <request|vxid>] [-h] [-n name] [-N filename] [-P file] [-q query] [-V] [-w filename]


The varnishncsa utility reads varnishd(1) shared memory logs and presents them in the Apache / NCSA "combined" log format.

Each log line produced is based on a single Request type transaction gathered from the shared memory log. The Request transaction is then scanned for the relevant parts in order to output one log line. To filter the log lines produced, use the query language to select the applicable transactions. Non-request transactions are ignored.

The following options are available:

When writing output to a file, append to it rather than overwrite it.
Do all regular expression and string matching caseless.
Start processing log records at the head of the log instead of the tail.
-F format
Set the output log format string.
-g <request|vxid>
The grouping of the log records. The default is to group by vxid.
Print program usage and exit
-n name
Specify the name of the varnishd instance to get logs from. If -n is not specified, the host name is used.
-N filename
Specify the filename of a stale VSM instance. When using this option the abandonment checking is disabled.
-P file
Write the process' PID to the specified file.
-q query
Specifies the VSL query to use.
Print version information and exit.
-w filename
Redirect output to file. The file will be overwritten unless the -a option was specified. If the application receives a SIGHUP the file will be reopened allowing the old one to be rotated away.


Specify the log format used. If no format is specified the default log format is used.

The default log format is:

%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i"

Escape sequences \n and \t are supported.

Supported formatters are:

Size of response in bytes, excluding HTTP headers. In CLF format, i.e. a '-' rather than a 0 when no bytes are sent.
Time taken to serve the request, in microseconds.
The request protocol. Defaults to HTTP/1.0 if not known.
Remote host. Defaults to '-' if not known.
Total bytes received from client.
The contents of request header X.
Remote logname (always '-')
Request method. Defaults to '-' if not known.
The contents of response header X.
Total bytes sent to client.
The query string, if no query string exists, an empty string.
The first line of the request. Synthesized from other fields, so it may not be the request verbatim.
Status sent to the client
Time when the request was received, in HTTP date/time format.
Time when the request was received, in the format specified by X. The time specification format is the same as for strftime(3).
Time taken to serve the request, in seconds.
The request URL without any query string. Defaults to '-' if not known.
Remote user from auth
Extended variables. Supported variables are:
Time from when the request processing starts until the first byte is sent to the client.
Whether the request was a cache hit or miss. Pipe and pass are considered misses.
How the request was handled, whether it was a cache hit, miss, pass, pipe or error.
Output value set by std.log("key:value") in VCL.


Rotate the log file (see -w option)
Flush any outstanding transactions


The varnishncsa utility was developed by Poul-Henning Kamp in cooperation with Verdens Gang AS and Varnish Software AS. This manual page was initially written by Dag-Erling Smørgrav <des [at]>, and later updated by Martin Blix Grydeland.


This document is licensed under the same licence as Varnish itself. See LICENCE for details.

Copyright (c) 2006 Verdens Gang AS
Copyright (c) 2006-2014 Varnish Software AS


varnishd(1) varnishlog(1) varnishstat(1)